On Sat, Dec 08, 2007 at 07:35:54PM -0500, Theodore Tso wrote: > On Sat, Dec 08, 2007 at 05:20:17PM -0600, Matt Mackall wrote: > > random: do extraction before mixing > > > > If an attacker manages to capture the current pool state, she can > > determine the last 10 bytes extracted from the pool. > > That's not true; we aren't just extracting data in the > __add_entropy_words() call. In fact, above that, the bulk of the > extraction comes form when we hash the entire pool, feeding back a > portion of the hash into the pool here: > > for (i = 0; i < r->poolinfo->poolwords; i += 16) { > /* hash blocks of 16 words = 512 bits */ > sha_transform(buf, (__u8 *)(r->pool + i), buf + 5); > /* feed back portion of the resulting hash */ > add_entropy_words(r, &buf[i % 5], 1); > }
Ok, yes, I'd forgotten we were chaining in the final sha_transform. I plead too many bufs and buf+5s, which I fix up in 6/6. Funny thing is that I'd convinced myself that this attack didn't work (correct) last year when I read the paper I mentioned earlier. But yesterday and today I couldn't spot the problem with it. So again, I'll add an explicit comment for future hackers and researchers. -- Mathematics is the supreme nostalgia of our time. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/